git.iko.soy/typeable/oauth2-proxy
on master help sign in
Update documentation and changelog for redis store
fc06e2dBrian Van Klaveren
CHANGELOG.md+6
compare with master
unifiedsplit
@@ -14,6 +14,12 @@
14
14
15## Changes since v3.2.0
15## Changes since v3.2.0
16
16
17+- [#155](https://github.com/pusher/outh2_proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)
18+ - Implement flags to configure the redis session store
19+ - `-redis-connection-url`
20+ - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.
21+ - Sessions are stored encrypted with a per-session secret
22+ - Added Some tests for a Server based session store
17- [#168](https://github.com/pusher/outh2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
23- [#168](https://github.com/pusher/outh2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
18- [#169](https://github.com/pusher/outh2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)
24- [#169](https://github.com/pusher/outh2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)
19- [#148](https://github.com/pusher/outh2_proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)
25- [#148](https://github.com/pusher/outh2_proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)
docs/configuration/configuration.md+1
@@ -75,6 +75,7 @@ Usage of oauth2_proxy:
75 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov
75 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov
76 -redeem-url string: Token redemption endpoint
76 -redeem-url string: Token redemption endpoint
77 -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
77 -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
78+ -redis-connection-url string: URL of redis server for redis session storage type (eg: redis://HOST[:PORT])
78 -request-logging: Log requests to stdout (default true)
79 -request-logging: Log requests to stdout (default true)
79 -request-logging-format: Template for request log lines (see "Logging Configuration" paragraph below)
80 -request-logging-format: Template for request log lines (see "Logging Configuration" paragraph below)
80 -resource string: The resource that is protected (Azure AD only)
81 -resource string: The resource that is protected (Azure AD only)
docs/configuration/sessions.md+24
@@ -16,6 +16,7 @@ data in one of the available session storage backends.
16
16
17At present the available backends are (as passed to `--session-store-type`):
17At present the available backends are (as passed to `--session-store-type`):
18- [cookie](cookie-storage) (default)
18- [cookie](cookie-storage) (default)
19+- [redis](redis-storage)
19
20
20### Cookie Storage
21### Cookie Storage
21
22
@@ -32,3 +33,26 @@ The following should be known when using this implementation:
32- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
33- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
33cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
34cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
34users to re-authenticate
35users to re-authenticate
36+
37+
38+### Redis Storage
39+
40+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
41+back the the client for storage, as in the [Cookie storage](cookie-storage), a ticket is sent back
42+to the user as the cookie value instead.
43+
44+A ticket is composed as the following:
45+
46+`{CookieName}-{ticketID}.{secret}`
47+
48+Where:
49+
50+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
51+- The `ticketID` is a 128 bit random number, hex-encoded
52+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
53+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
54+to which the session is stored. The encoded session is encrypted with the secret and stored
55+in redis via the `SETEX` command.
56+
57+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
58+disclosure.
main.go+1−1
@@ -76,7 +76,7 @@ func main() {
76 flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")
76 flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")
77
77
78 flagSet.String("session-store-type", "cookie", "the session storage provider to use")
78 flagSet.String("session-store-type", "cookie", "the session storage provider to use")
79− flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")
79+ flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage type (eg: redis://HOST[:PORT])")
80
80
81 flagSet.String("logging-filename", "", "File to log requests to, empty for stdout")
81 flagSet.String("logging-filename", "", "File to log requests to, empty for stdout")
82 flagSet.Int("logging-max-size", 100, "Maximum size in megabytes of the log file before rotation")
82 flagSet.Int("logging-max-size", 100, "Maximum size in megabytes of the log file before rotation")